package com.cmwa.solution.filter;


import java.io.IOException;

import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest;

import org.slf4j.Logger;
import org.slf4j.LoggerFactory;

import com.cmwa.ec.base.util.SpringUtil;
import com.cmwa.solution.utils.spring.MyExceptionResolver;


/**
 * 过滤器，配置到web.xml，所有页面均需先经过此filter检查URL所带参数的合法性
 *
 *
 */
public class XxsParameterFilter implements Filter {
    protected String invalidCharSet;
    private static Logger logger = LoggerFactory.getLogger(MyExceptionResolver.class);
    /**
     * filter初始化
     *
     * @author songyb
     * @param FilterConfig
     *
     */
    public void init(FilterConfig filterConfig) {
        logger.info("xxs filter initializing");
        this.setInvalidCharSet(SpringUtil.getProperty("invalid_char_set"));
        
        if (invalidCharSet == null) {
//            invalidCharSet = "\'_;_$_%_\"_\\+_\\\\_<iframe_<script_script>_iframe>_alert\\(_\\+or\\+_\\+-_-\\+_null%2B_%3Ciframe_%3Cscript_script%3E_iframe%3E";
        	invalidCharSet = "$_%_\\\\_<iframe_<script_script>_iframe>_alert_onload_window.location_unescape_execscript_msgbox_confirm_prompt_vbscript_javascript_javascript_src_\\(_\\+or\\+_\\+-_-\\+_null%2B_%3Ciframe_%3Cscript_script%3E_iframe%3E";
        }
        logger.info("xxs filter rule : " + invalidCharSet);
        logger.info("xxs filter initialized");
    }

    public void doFilter(ServletRequest req, ServletResponse res,
                         FilterChain chain) throws IOException, ServletException {
        HttpServletRequest hreq = (HttpServletRequest) req;
        hreq = new FHttpServletRequest(hreq, invalidCharSet);
        chain.doFilter(hreq, res);
    }

    public void destroy() {
        logger.info("filter destroy");
    }

	public String getInvalidCharSet() {
		return invalidCharSet;
	}

	public void setInvalidCharSet(String invalidCharSet) {
		this.invalidCharSet = invalidCharSet;
	}
}
